LEGAL

Data Processing Agreement

Last updated: 1 November 2026

The operator agreement that applies when we process personal information for your company.

1. Parties and purpose

This Data Processing Agreement (the DPA) is made between the Client that has signed up for the Service (the Responsible Party) and Travel South Africa, a service of Pro Web Design (the Operator). It forms part of the Terms and Conditions and applies to personal information that the Operator processes for the Responsible Party when providing the Service.

It is the written contract that sections 20 and 21 of the Protection of Personal Information Act 4 of 2013 (POPIA) require between a responsible party and an operator. Words used in POPIA have the same meaning here.

2. Roles

The Responsible Party decides why and how personal information is processed in its dashboard, for example its bookings, passengers, drivers, staff and customers. The Operator processes that information only on behalf of the Responsible Party, to provide the Service. The Operator is responsible for the information it collects for its own business under its Privacy Policy.

3. Details of the processing

Purpose: hosting and running the dashboard, booking forms, dispatch, payments records, notifications, WhatsApp and booking provider connections, support and backups.
Duration: while the Terms are in force, and then until the data is returned or deleted under clause 11.
People concerned: the Responsible Party’s customers and passengers, its drivers and staff, and the people who contact it.
Types of information: names, phone numbers, email addresses, pick-up and drop-off addresses, flight and trip details, booking and payment status, driver and vehicle details, driver licence details, trip locations and messages sent through the Service.
Special personal information: none is intended. The Responsible Party must not load special personal information, or information about children beyond what a trip needs, unless it has a lawful reason and has told the Operator first.

4. Instructions

The Operator processes personal information only with the knowledge and authority of the Responsible Party, as set out in this DPA, the Terms and the Responsible Party’s use of the Service. If the Operator thinks an instruction breaches POPIA, it will tell the Responsible Party.

5. Responsible Party's duties

The Responsible Party must have a lawful reason to process the information, give its customers and staff the notices POPIA requires, collect the information for a specific and lawful purpose, and decide how long to keep it. It must tell the Operator if it needs the Operator to help with a request or complaint.

6. Confidentiality

The Operator treats personal information as confidential. It allows access only to people who need it to provide the Service and who are bound by a duty of confidentiality.

7. Security safeguards

As POPIA section 19 requires, the Operator takes appropriate, reasonable technical and organisational measures to prevent loss of, damage to and unauthorised access to personal information. They include:

a separate dashboard and separate data tables for each Client
role based access, with an audit log of changes
encrypted connections between users and the Service
secrets such as keys and passwords stored in protected form
regular backups, and testing that they can be restored
updates to the software and server that hosts the Service

8. Security compromises

The Operator will tell the Responsible Party immediately, and in any event within 48 hours, after it becomes aware of reasonable grounds to believe that personal information of the Responsible Party has been accessed or acquired by an unauthorised person, as POPIA section 21(2) requires. It will give the details it has, help the Responsible Party to meet its duty to notify the Information Regulator and the people affected, and take steps to limit the harm.

9. Sub-operators and connected services

The Responsible Party agrees that the Operator may use sub-operators that help to provide the Service, such as web hosting and email delivery providers. The Operator makes sure each one is bound by written terms that give the same level of protection, and stays responsible for them. The Operator will give notice of a new sub-operator that processes the Responsible Party’s information, and the Responsible Party may object on reasonable grounds.

Services that the Responsible Party chooses to connect, such as its payment gateway, Google Maps key, booking providers, WhatsApp provider and AI provider, are engaged by the Responsible Party under its own accounts and terms. The Operator is not their operator.

10. Transfers outside South Africa

The Operator transfers personal information outside the Republic only as POPIA section 72 allows, for example to a recipient that is bound by law, a binding agreement or binding corporate rules that give a similar level of protection, or with the consent of the people concerned.

11. Help with the rights of people

The Operator will give the Responsible Party reasonable help, through the Service or on request, so that it can respond to requests from people to access, correct or delete their information, and to objections and complaints. If a person contacts the Operator directly about information held for the Responsible Party, the Operator will refer the person to the Responsible Party, unless the law says otherwise.

12. Return and deletion

The Responsible Party may export its data from the dashboard at any time. When the agreement ends, the Operator keeps the data for 30 days so that the Responsible Party can return, and then deletes it. Copies in backups are overwritten in the normal backup cycle. The Operator may keep information that the law requires it to keep.

13. Checking compliance

The Operator will give the Responsible Party the information it reasonably needs to show that this DPA is being followed. The Responsible Party may, on reasonable written notice, no more than once a year and during business hours, ask for an audit. The audit must not endanger the information of other Clients, and the Responsible Party pays its own costs.

14. Liability and law

The limits on liability in the Terms apply to this DPA, to the extent the law allows. This DPA is governed by the laws of the Republic of South Africa. If it conflicts with the Terms about personal information, this DPA applies.

Related documents: Terms and Conditions, Privacy Policy, Data Processing Agreement and Refund Policy. Questions? Write to [email protected].